Bluefin Image Contents#

Bluefin ships across three distinct images, each with a different mechanism for defining what goes into it:

Production Bluefin builds as a Containerfile overlay: it starts from a base image and installs RPMs. Common branding, udev rules, wallpapers, and shared system files are assembled in the projectbluefin/common repo and imported into the image 1. The ~80 base RPMs plus ~60 DX-variant packages are all managed via dnf in these Containerfiles.

Dakota takes the opposite approach — no RPMs, no dnf, no Containerfile package installs. Its Containerfile is a lint helper only 2. All image content is declared as BuildStream .bst elements. 3

The authoritative package manifest for Dakota is elements/bluefin/deps.bst — a kind: stack element that wires every Dakota-specific component into the dependency graph. 4

Naming note: The elements/bluefin/ path is historical. These are Dakota's BST paths — not a signal that the dnf/RPM workflow applies. 5

Dakota Package Manifest (deps.bst)#

elements/bluefin/deps.bst is kind: stack — it produces zero filesystem output; it exists solely to aggregate dependencies into the build graph. 6

Bluefin-Specific Elements#

7

From Upstream Junctions#

Dakota pulls additional components directly from its upstream junctions:

8

Notable Dakota-Specific Components#

The components below are unique to Dakota or built differently than their production Bluefin equivalents:

Memory-safe Rust replacements — Dakota's defining characteristic. sudo-rs (sudo-rs.bst) installs sudo with setuid bit (4755) and a sudoedit symlink. 9 uutils-coreutils (uutils-coreutils.bst) replaces most GNU coreutils with Rust equivalents; cp, mv, and rm are intentionally excluded due to unresolved TOCTOU issues. 10

Ghostty terminal — built from source via Zig (ghostty.bst), with GTK4/Wayland dependencies vendored inline. 11

Incus — system container and VM manager v7.2.0 (incus.bst), built from upstream release tarballs with vendored Go deps. Pulls in cowsql/raft/libuv, liblxc, and lxcfs. QEMU/dnsmasq/nftables come from junctions. 12

uupd — the Universal Blue Update daemon ships as a pre-built binary (v1.4.0) with a daily 4:00 AM systemd timer. Manages brew, distrobox, flatpak, and system updates with polkit rules for unprivileged invocation. 13

Tailscale — pre-built binary (v1.98.3), x86_64 and aarch64, with a patched systemd unit for the tailscaled service. 14

Distrobox — ships the Go rewrite (next branch, v1.8.2.5) with bash/zsh completions and man pages, depends on podman. 15

Dakota vs. Production Bluefin — Gap Analysis#

Dakota is a curated subset of production Bluefin, not a 1:1 clone. 16 It intentionally excludes things impractical for from-source builds and adds components unique to its from-source approach.

What's Missing From Dakota (present in production Bluefin)#

What Dakota Has That Production Doesn't#

Permanently Out of Scope for Dakota#

Nvidia drivers, ZFS, Xbox controller support (xone), Framework laptop modules, enterprise AD/Kerberos — building these from source is not practical. 16

Checking Current Package Versions#

The Changelogs and Feeds page tracks current versions across all Bluefin streams (production, LTS, Dakota). For verifying live image contents, use skopeo inspect ghcr.io/projectbluefin/dakota:stable or podman run --rm — not a local machine unless you're explicitly checking your own install. 16

Key Source Files#

BST Caching Gotcha#

Adding a package to deps.bst (kind: stack) does not automatically trigger a rebuild of downstream compose layers in non-strict mode — the package will be missing from the final image even though bst show lists it. Force a clean rebuild with:

just bst --no-cache-buildtrees build oci/bluefin.bst

17